emotet | ad209b124cabd29baa4fb14959da775d84e789364ce3231c27ebbb98dcfbaa40

Analysis

Target
293ccb283afa6ce3582bf5b8ca9278b4.dll
Size 548KB
Sample220701-a2b8ysfec9
SHA256 ad209b124cabd29baa4fb14959da775d84e789364ce3231c27ebbb98dcfbaa40
MD5 293ccb283afa6ce3582bf5b8ca9278b4
SHA1 b64e72de683f1ea7a7b217d00b93aea01a5d90a5
SHA512 166567ccab997b9ec8298a40ec23c000731dd530c62d57bae0b5eec907dbec8bf0b0b2ab9e04de87d80a49731cbef9eb1b7ecbc88567d5927397ac96b7ef18dd
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1600	regsvr32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1208	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1208	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1208	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1208	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1208	1600	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\293ccb283afa6ce3582bf5b8ca9278b4.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\system32\regsvr32.exe
  C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IntwdXE\PRUMnlWv.dll"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1208

memory/1600-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download

memory/1600-55-0x0000000000530000-0x000000000058A000-memory.dmp

Download